Why Airport Security Is Broken—And How to Fix It (former head TSA) - <AUTHOR> http://online.wsj.com/article/SB10001424052702303815404577335783535660546.html?mod=WSJ_hps_editorsPicks_1 <comment><USER2> "No security agency on earth has the experience and pattern-recognition skills of TSA officers"

really? having watched three TSA officers debate for five minutes over whether or not peanut butter was a liquid and concluding that "well, peanut butter goes on peanut butter and jelly sandwiches, and we don't allow petroleum jelly through, so we don't allow peanut butter through either", I really am skeptical of this claim...

<comment><USER3> Allow the guy to be gentlemanly regarding the skill and dedication of his former employees, many of whom happen to be ex-military.

<comment><USER4> > many of whom happen to be ex-military.

This seems somewhat irrelevant? I know we're always supposed to be "supporting the troops", but I think you're suggesting we should be supporting professions that they may later go into?

<comment><USER5> It is just good sense to speak politely about a crew of thousands of people who have been specifically trained to kill without remorse.

<comment><USER6> Wow, are US vets that tweaked? I mean, just say a bad thing about them and they will kill you, with out remorse? Blimey, sounds a bit worrying to me. You make them sound like a bunch of well armed psychos living on a hair trigger. Such people roam free in the US? Sounds terrifying.

Or are you doing them a bit of a disservice there?

</comment></comment></comment></comment></comment><comment><USER7> What exactly is stopping someone from sitting on their house near the airport and taking potshots at landing planes with a homebuilt rocket launcher? Nothing. And yet it never happens.

We all need to calm down and accept the fact that, once in a while, a plane will blow up and 300 people will die. 9/11 is a rounding error compared to deaths from heart disease or car crashes, but we don't seem to be doing much about those.

<comment><USER8> There's many things stopping someone from creating and using a rocket launcher capable of taking down aircraft without being caught. Mostly the technical difficulty, but the FBI's tactics for finding bomb-makers would probably find a rocket-launcher-maker.

<comment><USER9> The FBI's tactics for finding bomb-makers would presumably find a bomb-laden passenger as well then?

<comment><USER4> Which is indeed how most bomb plots are foiled.

<comment><USER5> Most bomb plots are mentally ill or disabled people enticed, set up, and entrapped by the FBI.

<comment><USER10> That's an extraordinary claim, and if untrue, libelous as well. Have you any evidence to present?

<comment><USER11> In numerous cases the FBI has been accused of entrapment... [http://www.guardian.co.uk/world/2011/sep/29/fbi- entrapment-r...](http://www.guardian.co.uk/world/2011/sep/29/fbi-entrapment- rezwan-ferdaus)

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> What's with all these references to al Qaeda?

 _No realistic amount of prescreening can alleviate this threat when al Qaeda is working to recruit "clean" agents_

 _al Qaeda's advancing skill with hydrogen-peroxide-based bombs..._

etc, etc.

After 10+ years of war, the al Qaeda of 9/11 is pretty much finished. The organization can barely survive in Afghanistan and are being picked off by drones in Yemen.

Realistically, al Qaeda is a defunct organization, and this article repeadly mentions al Qaeda like it's some eternal bogeyman. This distraction tactic is to drive attention away from the fact the methods for "How To Fix The TSA" merely reinforce the status quo.

None of the former head of the TSA's 5 suggestions reduce wait times or make the experience of flying more pleasant. You _still_ have to take off your shoes and get scanned or patted down. There's _still_ going to be that person at the head of the line who scribbles on your boarding pass after checking your ID.

I would like to see a radical rethink of airport security, something that would put a smile on the face of the passengers and the security officers.

<comment><USER13> Given what the TSA has become, I can't believe people are willing to take seriously an article written by a former TSA head.

These people are not our friends.

</comment></comment><comment><USER14> The last line of the article is the most important: "If Americans are ready to embrace risk, it is time to strike a new balance."

If we could stop being cowards and accept that we might die, or our families might die, then we might fight these invasive policies. I'd love it if efficacy, privacy, and freedom were once again as given the same weight as security.

I don't hear many calls for courage, so I applaud even this veiled statement.

*edit - spelling.

<comment><USER15> Problem is most normal people wouldn't agree with that choice.

30 seconds of inconvenience OR a more secure airplane.

I guarantee 99% of people choose the second option.

<comment><USER16> Even it was 30 seconds, and it probably more like 2 - 3 minutes, that is for each passenger. Most normal people don't believe in security theatre and most normal people wouldn't agree with you.

</comment></comment></comment><comment><USER17> _I wanted to reduce the amount of time that officers spent searching for low- risk objects, but politics intervened at every turn.... And despite the radically reduced risk that knives and box cutters presented in the post-9/11 world, allowing them back on board was considered too emotionally charged for the American public._

Ugh. Was that true? What if the TSA had announced they had determined that knives and lighters no longer posed a significant risk? It might have helped the American psyche a little bit to hear the government reassuring people instead of stoking their fears. It sucks that all our confidence-building Bush-giving-us-our-mojo-back demonstrations of "strength" were military operations in foreign countries thousands of miles away, while at home citizens were taught to be afraid of pocket knives and nail clippers.

<comment><USER18> Knives and box cutters never posed a significant risk. You can't take over a plane with a knife if everyone on board is against you.

I bet you'd have a hard time keeping command with a machine gun if people are swarmed against you knowing (a) they will die anyways and (b) if they don't stop you people they love will be killed as well.

<comment><USER19> Actually, knives were a "significant risk" before cockpit doors were reinforced and required to remain locked.

<comment><USER20> No, that may help keep a guy with a gun out, but a guy with a knife is screwed even if the cockpit doors are wide open. Why? Pre-9/11, the wisdom was to let hijackers go ahead and take control of the plane -- they just want to detour it and land it somewhere to get away from the police and whatnot. Post-9/11, a guy pulling out a knife will end up beaten to death before he makes it half a dozen rows; when people start crashing hijacked planes into buildings, the wisdom changed. Cockpit doors have nothing to do with it.

<comment><USER15> That is the stupidest logic I've heard in a while.

Do you really think someone trying to kill the pilot would be waving the knife around in the air causing a scene ? No. They would do so quietly.

You know. So passengers don't know what they are doing.

<comment><USER21> And you win for the most stupid response. Fuckhat.

Do you really think it will make any difference whether the hijacker kills the pilot or not? He is still going to be beaten to death (and the control tower os going to tell whomever pilots the plane exactly which knobs to turn to land the plane, if the autopilot can't.

<comment><USER22> Play nice.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> I am intrigued that whole-body scanners were not mentioned once in the article. I am choosing to assume that Hawley's opinion of them is something he doesn't feel comfortable publicizing.

</comment><comment><USER24> There's nothing broken about airport security, it's working perfectly. Its purpose is to keep you voting for certain politicians who spend your taxes on expensive, ineffective gadgets made by their cronies. "Fear is the mind killer", as a great writer once said.

</comment><comment><USER25> "And we had explosives experts retrain the entire work force in terrorist tradecraft and bomb-making."

So, are we training our underpaid and possibly disgruntled TSA workers to detect items of suspect or are we training them to become the suspect? I don't want to generalize, but training everyone in the agency in "terrorist tradecraft and bomb-making" is about the dumbest thing you could do. On so many levels.

<comment><USER8> They were trained in _how to recognize_ terrorist tradecraft and bomb-making, not how to make actual bombs.

<comment><USER26> How good can someone be at recognizing terrorist tradecraft and bomb-making while knowing nothing about making actual bombs?

</comment></comment></comment><comment><USER27> Great article!

I think it gives some insight into the challenges that the TSA faces. They don't have complete autonomy, and like any massive organization, politics plays a huge role.

I have no doubt there are some really smart and innovative people at the TSA, but as anyone who worked in a huge bureaucracy knows, you often spent 90% of your time trying to please everyone and 10% actually doing real work.

</comment><comment><USER28> "Never again will a terrorist be able to breach the cockpit simply with a box cutter or a knife. The cockpit doors have been reinforced, and passengers, flight crews and air marshals would intervene."

Not true. Cockpit door opens when the captain takes a piss. Flight crews are usually sleeping at the back of the plane or stuck behind those beverage carts. Very few flights have air marshals and most passangers are tied up in their chairs with the seatbelt. I agree it is less likely than in the past, but definitely not impossible.

<comment><USER29> When I flew Southwest a couple weeks ago, a flight attendant specifically stood watch while the captain used the restroom, and had any passengers who walked up return to their seats.

<comment><USER7> Is that really going to stop someone intent on murdering a few hundred people?

<comment><USER29> I'm not sure how to answer that. The cockpit door was locked except for the brief moment when the pilot exited and re-entered the cockpit, and during that time a flight attendant was standing watch. I'm not sure how much more could be done, but it seemed to me it was a fairly significant obstacle to anyone hijacking the plane, considering that passengers would also hopefully assist in preventing a terrorist from succeeding.

</comment></comment></comment></comment><comment><USER30> "Accenture..."

Ah -- great to see another wonderful contribution by management consultants...

<comment><USER31> I have to disagree with your blanket generalization. In most cases, consultants cause more problems than solutions. However in this case, the consultants from Accenture made some clever observations and delivered solutions that were economically effective for the cash-strapped TSA. I would have to argue that these consultants are actually "hacking" the system to make it easier for passengers, based on some sound cognitive science and psychology principles.

</comment></comment><comment><USER32> There is an easier way to fix it: Incentivize safety. Get rid of the TSA all- together, and charge the departing airport for the damages caused by any attempted or successful attack. The airport will have to balance the risk of an attack leaving from their location with the risk of losing all their money from people not flying. It's the same calculation they use (more or less) when they buy their insurance, so it should be a no-brainer.

On top of that, actually punish people for willful violations of basic constitutional rights to keep whoever the airports hire from getting too big for their breeches (unlike the TSA...), and the problem -- if it actually exist -- should resolve itself.

<comment><USER5> Who exactly is this "airport" you would hold accountable? Who owns SFO?

Have you tried buying terrorism insurance recently? Guess who the primary provider of that insurance is.

Would your proposed model have prevented 9/11 somehow?

<comment><USER33> > Who owns SFO?

The San Francisco Airport Commission. Or am I not understanding the question?

</comment></comment></comment><comment><USER34> While I disagree with a large number of TSA policies, I have found TSA officers to be thoroughly professional and nearly always courteous. The anti- TSA bandwagon on HN seems to be the product of people who don't travel much basing their opinions on a few rants or CNN coverage, or perhaps just general anti-authority bitterness.

I've flown at least once a month for 10 years, domestically and internationally, and almost never have a negative experience with TSA personel. While I hate taking off my shoes, turning off my phone, and find the liquid rules particularly ridiculous, I have found that TSA agents have more than met my expectations of professionalism in implementing policies over which they have no control.

Millions of people travel every day. A few bad encounters can be expected. Don't be an asshole and tear down the employees of the TSA because of a few anecdotal occurrences. In doing so, you are just as bad as an ignorant talking head on Fox News. Think and put yourself in others shoes before you rant.

<comment><USER13> I think you're making a straw man. The anti-TSA bandwagon is not due to the fact that a small but significant number of TSA agents are very rude.

It's more due to the fact that a massive and totally unaccountable police force has been created that violates people's rights left and right, and has also been shown to be almost totally ineffective, despite costing billions of dollars.

Meanwhile, the federal goverment seems to have _everything_ wiretapped. We now life in a "turnkey totalitarian state." [1]

This seems to bode quite badly for the future of the American experiment in individual rights.

[1] [http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/al...](http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/all/1)

<comment><USER15> I love how anti-TSA supporters seem to forget that EVERY country has a "massive and totally unaccountable police force" that "violates people's rights left and right".

It's just American's anti-police, anti-government, anti-authority streak that cause them to rise up against it.

<comment><USER6> Er, no, my country does not.

And there is a substantial view round the rest of the planet that America is a "massive and totally unaccountable police force" that it "violates people's rights left and right", as discussed here, for one example, when certain web sites get taken down and people who have never stepped foot in the USA suddenly have to be sent there to face American "justice", which Americans them selves seem most uncomfortable with.

Stones, glasshouses and all that.

<comment><USER23> The claim "my country does not" would be more compelling if you named the country.

</comment></comment></comment></comment></comment><comment><USER35> The only thing liquids could is if X takes a liquid, say alcohol or other flammable liquids, spray and light up in a seconds. Not sure how the physics work with the plane's config but that may be a problem.

As for the rest, he /she will have to deal with dozens or hundreds of passengers and a knife will just not do.</comment>


Milagro: Distributed Cryptosystem for Cloud Computing - <AUTHOR> http://milagro.incubator.apache.org/ <comment><USER2> I see a lot of talk and little substance.

"You can have 128bit security with a 4 digit pin"....

No, No you can't. A 4 digit pin is 14 bit security. Any system is only as secure as its weakest link.

It's not a password it's a pin... Dear god, how have we not got past this yet.

While it's good to see an acceptance that iot is fundamentally unworkable on current infrastructure. I am a long way from being convinced this will be it's saviour.

EDIT:Furthermore: [https://github.com/apache/incubator-milagro- crypto/blob/mast...](https://github.com/apache/incubator-milagro- crypto/blob/master/java64/TestMPIN.java) /* Client and Server are issued secrets by DTA */

HELL NO.!.!.!.!.!

<comment><USER3> There's an accompanying talk (and slides) that was given at apachecon earlier in the summer. I heard some of the talk (from the OP linked page.. not in person) . The essence of DTA seems to be that it creates key-pairs for both ends of the communication (client and server), multiple DTA's combine to create the private keys and the keys are being distributed to the client side through some out-of-band "protected" channel.

The use-case is not billions of browsers connecting to millions of webservers (as in PKI based TLS) but a small number of controllable client end points (a native app binaries on mobile or IoT devices) connecting to a handful of servers.

The mental image I came away with (not sure if it's 100% correct) is think of an distributed infrastructure to create SSH key-pairs (where PIN is equivalent to the passphrase for the private key).

Wonder if anybody from the Milagro team feels like responding to this thread. It's on HN front-page right now and would be a great chance for the creators to engage with the community.

<comment><USER2> :( sounds terrible.

I went from eurphoria, to cynicism, to total foil hat in less than an hour.

This sounds incredibly like having multiple points of failure (what happens if one of the DTAs is unavailable?) and no public key cryptography (DTAs creating the secret key).

<comment><USER3> I'll freely admit to neither remotely being a security expert nor being completely confident I got the details right from listening to the talk. It really would help if someone from the actual team engaged the community here (or some other appropriate forum)

</comment></comment></comment></comment><comment><USER4> Okay, here is what I think this is

\- It is a straight forward combination of two forms of encryption from pairing cryptography world. Identity Based Encryption and Threshold Encryption.

\- In Identity based encryption, your public key and private key is generated by an identity provider based on an identity string provided to it. This allows encrypting messages to party that hasn't yet recieved the keys. This work has been around for ages.

\- Milagro proposes to distribute the trusted third party by having multiple identity providers. The public key and private key are formed from a threshold encryption/ decryption procedure.

<comment><USER5> Rogaway has some concerning things to say about IBE here:

[http://web.cs.ucdavis.edu/~rogaway/papers/moral- fn.pdf](http://web.cs.ucdavis.edu/~rogaway/papers/moral-fn.pdf)

It'd be a tangent, except that Milagro proposes to alter the TLS handshake to accommodate their scheme.

<comment><USER6> Thanks for the link. I think I saw his talk about the topic and that milagro resonates well with it. The use of threshold encryption works around an unfortunate aspect of IBE and is practical today.

PS: As I grow older, I become more accepting of the fact that state power is not going anywhere soon. If multiple authorities (preferably under different jurisdictions) can be coerced into deriving client secrets for law enforcement with proper oversight, like public visibilty of the amount intervention and auditabilty by data protection officers, that would be acceptable to me and better than outlawing homebrewed encryption or more drastic backdooring measures.

</comment></comment></comment><comment><USER3> [http://docs.milagro.io/en/milagro-a-case-for-something- new-p...](http://docs.milagro.io/en/milagro-a-case-for-something-new- part-1.html)

Finally. We need for the security community to jolt themselves out of their unhealthy focus on PKI based TLS as the be-all and end-all for client-server communication... which has been driven by web browsers as the main use-case for the last couple of decades -- to something better and more secure for the new mobile world. Not sure Milargo presents a complete solution but hopefully it sparks a dialog for better solutions for native apps and IoT world.

[http://www.infoworld.com/article/3016733/application- develop...](http://www.infoworld.com/article/3016733/application- development/in-search-of-a-cure-for-slow-mobile-downloads.html)

</comment><comment><USER7> There is little information about what this is exactly on the site (but lots of words.) And since their proposal is just "TBC" at the moment, I'll see if I can give it a shot...

Milagro uses 'Pairing-Based Cryptography' to do better decentralization of trust. This concept was new to me, briefly it seems like it uses special constructs of elliptic curves to provide zero-knowledge proofs and Diffie- Hellman style key exchange.

So, instead of using CAs and certificates to prove identity, this system would use indnividual pairings for authorization and would end up being more decentralized.

With M-PIN that is a big part of this library, you can have signatures but also upgrade to full key agreement and PFS, with a standard protocol that has been around since 2002.

What I am unsure about is how the decentralization will work, especially compared to just having CAs cross-sign keys. Seems like you will always need to ultimately have some trust anchor somewhere? Or can have a Perspectives- like 'network notary' system?

<comment> shawn-butler Milagro envisions a new class of cryptographic service providers called Distributed Trust Authorities, or D-TAs for short.

The purpose of a D-TA is to independently issue shares, or fractions, of cryptographic keys to Milagro clients and servers and application endpoints which have embedded Milagro cryptographic libraries. D-TAs operate independently from each other, are isolated in totality, and completely unaware of the existence of other D-TAs.

In practice, a Distributed Trust Authority (D-TA) framework would split the functions of a pairing-based key generation server into three services, each D-TA issuing thirds of private keys to distinct identities.

</comment></comment><comment><USER8> Great.

Now, if instead of starting with a half-baked implementation in Java that involves 36 configuration files and an artisanally sculpted Maven build, how about we make a spec, in terms of API docs and compliance tests.

Anything conforming to the spec which passes the tests is considered a valid implementation.

(Had to get that off my chest. Thanks.)

<comment> T-A Looks like Python to me: [https://github.com/apache/incubator-milagro-mfa- server](https://github.com/apache/incubator-milagro-mfa-server)

The core MFA library seems to be C, with a bunch of implementations (wrappers?) in Java, C#, JS, Python, Go and Swift:

[https://github.com/apache/incubator-milagro- crypto](https://github.com/apache/incubator-milagro-crypto)

<comment><USER8> I admit I didn't even look at any code. I've been conditioned to have expectations in-line with my rant.

</comment></comment></comment><comment><USER9> So one of the key benefits of this system is that two (or more) distributed CA's issue the certificate so if one is compromised (or the government demands access) the server (and client) are still safe?

</comment><comment><USER10> _" Apache Milagro (incubating) establishes a new internet security framework purpose-built for cloud-connected app-centric software and IoT devices that require Internet scale."_

Are they trying to achieve some kind of 'most buzzwords per sentence' world record or smth?

</comment><comment><USER8> Milagro is Spanish for "Miracle".

</comment><comment><USER11> Excellent [cheap] tequila, by the way!</comment>


Ask HN: Why are sub-optimal computer languages the most popular in the world? - <AUTHOR> How did sub-optimal languages like Python and JavaScript get to be the most popular languages in the world? Saying because they were widely available doesn't make sense to me, because vendors early on could see them becoming popular and fixed them or come up with a replacement before they got so entrenched. <comment><USER2> When PHP came out it was a big hit because of deployability. Cheap web hosts could install it and hack out quick scripts, or more important, install WordPress.

There were a few subtle points in how it was built that meant you could write bad scripts and not crash the server. There were commercial alternatives, some pretty spiffy, but they were expensive and risky (you could test PHP for yourself or you go up the chain of command to pay $5000 for a Cold Fusion license then be stuck with it if you don't like it.)

Other communities working on blub languages thought that the good properties of PHP were not important. They might have been minimal but they were not viable.

</comment><comment><USER3> For JavaScript, the answer is pretty obvious: there simply weren't (and still aren't, really) any alternatives.

For Python, it's really a phenomenon of trends. It's got all the right pieces (easy to learn and use, good community, good library ecosystem), but lots of languages have that. Like so many other things... It became more popular because it was popular.

Runtime performance is only one factor in the programming language game. Many other equally important factors are purely emotional. We are human, after all.

</comment><comment><USER4> Because for the vast majority of purposes, ease of developer use far outweighs performance.

Also, JavaScript has long had a monopoly on the worlds most popular deployment platform.

</comment><comment><USER5> No language is optimal in every dimension. Choosing a language is choosing (subjectively as well as objectively) which dimensions you care about.

</comment><comment><USER6> What do you mean by term "sub-optimal"?</comment>


Facebook Works with Google to Let Mobile Users Get Push Notifications via Chrome - github-cat http://techcrunch.com/2015/09/14/facechrome/#.ll8vkv:tgsK <comment><AUTHOR> "A big reason developers hate mobile websites is that they lack the push notifications which help re-engage people with native apps."

In other words: "A big reason users like mobile websites is that they lack the push notifications which keep annoying people with native apps."</comment>


Ask HN: Do you read through mobile app intros? - <AUTHOR> Upon an installation of a mobile app you will often see a series of pages "welcoming" you to the app. Maybe throw a few descriptions about the app, etc.
Do you read through them? Or do you just fly through them to get to the real stuff?
Is there a better/best solution to this? <comment><USER2> I don't 'discover' apps -- I always download a specific one I'm looking for (based on external reviews, friend's recommendation, etc). So these interstitial pages are rarely useful to me.

I suppose the answer might be different if I were downloading an app I've never heard of before, but I am also having difficulty imagining why I'd want to do that.

</comment><comment><USER3> Good grief no. A better solution is a "help" menu item.</comment>


Urbit and the impatience principle - <AUTHOR> https://dividuals.wordpress.com/2015/10/23/urbit-and-the-impatience-principle/ <comment><USER2> The mismatch comes about because Urbit is currently for Urbit developers, and will be for a while - and even by those standards it's in alpha. The path from , say, "merge this code to a desk manually" to "click this button on your urbpanel" is just one of infrastructure and schlep work, and it'll inevitably happen - either our community developers will standardize, or core developers will come up with something. For a silly analogy, we're still burying the gold under California and teaching prospectors how to work a pan individually - BART comes later. (Our user experience will be vastly better than BART, of course.)

Ideally, the average user won't actually host their urbit, but they will administrate it, in the same sense that they administrate their smartphone today. Server administration today is Unix administration, not iPhone administration. The demand for something that's more like iPhone administration has, so far, given us more containerized and sandboxed Unixes. Urbit is a bet that the solution to this demand is developing for a 2010s network OS rather than running tiny, restricted copies of a 1970s mainframe OS.</comment>


Was moon-smashing mission doomed from the start? - <AUTHOR> http://www.newscientist.com/article/dn17991-was-moonsmashing-mission-doomed-from-the-start.html?DCMP=OTC-rss&nsref=tech <comment><USER2> Robotic (unmanned) missions will always return vastly less information than manned. They can't adapt to circumstance well, mission goals can't be rewritten while in-flight, and its very hard to estimate risk from 250,000 miles away.</comment>


Visualized: Android activations mapped geographically, chronologically - <AUTHOR> http://www.engadget.com/2011/02/24/visualized-android-activations-mapped-geographically-chronolog/

<comment><USER2> Why submit the Engadget link? They sourced it from [0] who saw it as a YouTube video [1].

[0] [http://www.androidcentral.com/android-activations- visualized...](http://www.androidcentral.com/android-activations-visualized- oct-08-jan-11)

[1] <http://www.youtube.com/watch?v=fqFpq9WXbJo>

</comment><comment><USER3> I am going to vote that top visualisation, ever. I am so jealous right now.

<comment><USER4> There's still time to get an Android device.

<comment><USER3> I have one. I was commenting on the quality of the visualisation.</comment></comment></comment>


If Smart Is the Norm, Stupidity Gets More Interesting - <AUTHOR> http://www.nytimes.com/2012/10/23/health/if-intelligence-is-the-norm-stupidity-gets-more-interesting.html

<comment><AUTHOR> Editing has happened to this comment since the first reply was posted to it. At first I just shared some links to scholarly articles on genetic influences on human intelligence, as I was about to go out the door to have a walk with my son the hacker as this article reached HN's front page. Now I'm back at my computer to provide some more commentary on helpful background reading for the newspaper article from today (which I learned about from a researcher on this issue). Over the years here on HN, I have often seen mistaken conclusions about "heritability" and its relationship to human intelligence from HN participants who haven't kept up with the current research literature. I keep up with the current research literature on human behavioral genetics by weekly visits during the school year to the Readings in Behavioral Genetics and Individual Differences Psychology "journal club" (graduate seminar) at the University of Minnesota.

<http://www.psych.umn.edu/ugrad/pastsyllabi.html>

(One or two past syllabuses of the seminar are available above. The current course page

<http://www.psych.umn.edu/courses/mcgue/psy8935/>

has log-in authentication to facilitate sharing current journal articles among seminar participants. The seminar also has an email list from which I learned about the New York Times article submitted here, just after today's seminar.)

An old-fashioned view of heritability estimates for human intelligence, which I see repeated frequently on HN, is that heritability constrains controllability ("malleability") of human behavioral traits. Nothing could be further from the truth.

Johnson, Wendy; Turkheimer, Eric; Gottesman, Irving I.; Bouchard Jr., Thomas (2009). Beyond Heritability: Twin Studies in Behavioral Research. Current Directions in Psychological Science, 18, 4, 217-220

[http://people.virginia.edu/~ent3c/papers2/Articles%20for%20O...](http://people.virginia.edu/~ent3c/papers2/Articles%20for%20Online%20CV/Johnson%20\(2009\).pdf)

is an interesting paper by some of the researchers most familiar with research on human twins, including the director of the Minnesota Study of Identical Twins Reared Apart, which includes the statement "Moreover, even highly heritable traits can be strongly manipulated by the environment, so heritability has little if anything to do with controllability. For example, height is on the order of 90% heritable, yet North and South Koreans, who come from the same genetic background, presently differ in average height by a full 6 inches (Pak, 2004; Schwekendiek, 2008)."

Another interesting paper,

Turkheimer, E. (2008, Spring). A better way to use twins for developmental research. LIFE Newsletter, 2, 1-5

[http://people.virginia.edu/~ent3c/papers2/Articles%20for%20O...](http://people.virginia.edu/~ent3c/papers2/Articles%20for%20Online%20CV/Turkheimer%20\(2008\).pdf)

admits the disappointment of behavioral genetics researchers. Eric Turkheimer, a leading scholar in the Behavior Genetics Association, points out that the interpretation often given to "heritability" findings that they somehow measure genetic constraint on variation in a human trait is wrong.

"But back to the question: What does heritability mean? Almost everyone who has ever thought about heritability has reached a commonsense intuition about it: One way or another, heritability has to be some kind of index of how genetic a trait is. That intuition explains why so many thousands of heritability coefficients have been calculated over the years. Once the twin registries have been assembled, it's easy and fun, like having a genoscope you can point at one trait after another to take a reading of how genetic things are. Height? Very genetic. Intelligence? Pretty genetic. Schizophrenia? That looks pretty genetic too. Personality? Yep, that too. And over multiple studies and traits the heritabilities go up and down, providing the basis for nearly infinite Talmudic revisions of the grand theories of the heritability of things, perfect grist for the wheels of social science.

"Unfortunately, that fundamental intuition is wrong. Heritability isn't an index of how genetic a trait is. A great deal of time has been wasted in the effort of measuring the heritability of traits in the false expectation that somehow the genetic nature of psychological phenomena would be revealed. There are many reasons for making this strong statement, but the most important of them harkens back to the description of heritability as an effect size. An effect size of the R2 family is a standardized estimate of the proportion of the variance in one variable that is reduced when another variable is held constant statistically. In this case it is an estimate of how much the variance of a trait would be reduced if everyone were genetically identical. With a moment's thought you can see that the answer to the question of how much variance would be reduced if everyone was genetically identical depends crucially on how genetically different everyone was in the first place."

I regret that the recent review article "The neuroscience of human intelligence differences" by Deary and Johnson and Penke (2010), relating specifically to human intelligence,

[http://www.larspenke.eu/pdfs/Deary_Penke_Johnson_2010_-_Neur...](http://www.larspenke.eu/pdfs/Deary_Penke_Johnson_2010_-_Neuroscience_of_intelligence_review.pdf)

has not received more discussion on HN. "At this point, it seems unlikely that single genetic loci have major effects on normal-range intelligence. For example, a modestly sized genome-wide study of the general intelligence factor derived from ten separate test scores in the cAnTAB cognitive test battery did not find any important genome-wide single nucleotide polymorphisms or copy number variants, and did not replicate genetic variants that had previously been associated with cognitive ability[note 48]."

The review article Johnson, W. (2010). Understanding the Genetics of Intelligence: Can Height Help? Can Corn Oil?. Current Directions in Psychological Science, 19(3), 177-182

[http://apsychoserver.psych.arizona.edu/JJBAReprints/PSYC621/...](http://apsychoserver.psych.arizona.edu/JJBAReprints/PSYC621/Johnson%20Current%20Directions%20Psych%20Science%202010%20\(G%20and%20E%20in%20IQ\).pdf)

is an article I submitted as a new submission on HN a little while ago. The article looks at some famous genetic experiments to show how little is explained by gene frequencies even in thoroughly studied populations defined by artificial selection.

"Together, however, the developmental natures of GCA [that is, IQ] and height, the likely influences of gene–environment correlations and interactions on their developmental processes, and the potential for genetic background and environmental circumstances to release previously unexpressed genetic variation suggest that very different combinations of genes may produce identical IQs or heights or levels of any other psychological trait. And the same genes may produce very different IQs and heights against different genetic backgrounds and in different environmental circumstances."

The brand new review article

Chabris, C. F., Hebert, B. M., Benjamin, D. J., Beauchamp, J., Cesarini, D., van der Loos, M., ... & Laibson, D. (2012). Most reported genetic associations with general intelligence are probably false positives. Psychological Science.

[http://coglab.wjh.harvard.edu/~cfc/Chabris2012a-FalsePositiv...](http://coglab.wjh.harvard.edu/~cfc/Chabris2012a-FalsePositivesGenesIQ.pdf)

is especially important for discussing social science implications of what genetic studies have shown for years now. Social scientists are still catching up with how little certainty attaches to genetic studies of human intelligence --except for the certainty, as reported in today's article, that most genetic influences on IQ are small in effect.

"At the time most of the results we attempted to replicate were obtained, candidate-gene studies of complex traits were commonplace in medical genetics research. Such studies are now rarely published in leading journals. Our results add IQ to the list of phenotypes that must be approached with great caution when considering published molecular genetic associations. In our view, excitement over the value of behavioral and molecular genetic studies in the social sciences should be tempered—as it has been in the medical sciences—by a recognition that, for complex phenotypes, individual common genetic variants of the sort assayed by SNP microarrays are likely to have very small effects.

"Associations of candidate genes with psychological traits and other traits studied in the social sciences should be viewed as tentative until they have been replicated in multiple large samples. Failing to exercise such caution may hamper scientific progress by allowing for the proliferation of potentially false results, which may then influence the research agendas of scientists who do not realize that the associations they take as a starting point for their efforts may not be real. And the dissemination of false results to the public may lead to incorrect perceptions about the state of knowledge in the field, especially knowledge concerning genetic variants that have been described as 'genes for' traits on the basis of unintentionally inflated estimates of effect size and statistical significance."

I beg the pardon of the first participant to reply, who was annoyed by my submitting full journal citations with links to full text and relevant quotations of the article conclusions. In my own personal opinion, sometimes a Hacker News comment that links to sound research literature is more useful to participants here than expressions of personal opinion based on individual anecdotes. But reasonable minds can differ on such an issue, and I'm happy to add the commentary here that I once had a much different view of the genetic influences on human intelligence (the first popular articles I read on the subject, back in the 1970s and 1980s, were by Arthur Jensen and the late Richard Herrnstein) but I've had opportunity to learn about new research over the last twenty years, and I now know, and like to tell my friends on Hacker News, about the current consensus view that intelligence is largely a trait fixed in the genome of Homo sapiens, linked to hundreds of genes each of weak individual effect, and that most variance between one individual and another in IQ comes from poorly understood gene mutations and environmental influences that may be much more powerful than was once supposed.

<comment><USER2> I see your edit, thanks[1]. But there are better[2] ways to cite in a forum [3].

\--

[1] citation 1

[2] citation 2

[3] citation 3

<comment><USER3> Why is this better?

<comment><USER2> Because it is the universal standard, from when the internet protocols involved mail carriers and the packets involved sheets of paper. It is the universal standard because it interrupts the flow of thought as little as possible. If I decide I want read their articles, I will.

</comment></comment></comment></comment><comment><USER4> It could be even more complicated than that. Intelligence could be a question of proportion, like beauty.

<comment><AUTHOR> _Intelligence could be a question of proportion, like beauty._

Could you expand on that a little, please? How would a working scientist test the hypothesis you advance here?

<comment><USER4> In the simplest case, imagine that there are genes that determine quality x, and others that determine quality y, and intelligence depends on how close x/y is to some constant c.

If intelligence were determined by genes in that way, you wouldn't find it by looking for ("smart") genes whose presence was correlated with intelligence, or ("stupid") genes whose absence was.

I used beauty as an example because it seems unlikely that there is a single "beauty" gene whose presence makes human faces beautiful, but rather that beauty is a product of the interaction of multiple genes that control the dimensions of the face.

<comment><USER5> I would like to elaborate on that idea by saying that there is a feedback loop between the persons environment and his innate tendencies . I'm specifically referring to the feeling of satisfaction you get as you become better and better at something . It is that feeling of satisfaction and the inner drive that would provide the impetus needed to continue working harder and harder to master the discipline . However if all the components aren't in "proportion" , this feedback loop between practice -> improvement -> satisfaction -> urge to practice more gets broken .

</comment></comment></comment></comment><comment><USER6> Why is the idea of innate IQ still taken seriously if there's so little evidence for it? If intelligence is just the ability to think in a structured abstract way, doesn't it make sense to think of it as a skill developed over time? I mean, it's not hard to think of spending most of your time in a different mode of thought. I'd say that for most people their normal day to day tends to require concrete or social/emotional information processing.

If it seems that intelligence (specifically abstract structured thought) seems to stabilize early in life, maybe it's something that starts developing even earlier. A strategy for prioritizing, filtering, and processing information from a world of endless stimuli (of which abstract/structured would be only one such strategy) would start developing the moment we're born. By the time you're 10, you'd already have 10 years of "practice".

<comment><USER7> You are confusing things.

First and foremost you don't need evidence to look for evidence. A hypothesis is enough.

Secondly, there is evidence that IQ is at least in part genetic. There is no other way to explain geniuses, child prodigies, and mentally retarded individuals whose environments vary greatly.

<comment><USER8> Sure there is: chemical exposure balance or random variation in the uterine or infant environment.

Fetal alcohol syndrome reliably retards kids, and it isn't genetically inherited. Hypothetically, maybe something like adderall works in utero with lifelong effects.

Also, hypothesis formation should be motivated by data, or else you are wasting time searching through an exponential space with 0 probability of finding a correct one.

</comment></comment></comment><comment><USER9> Serendipity - just the other day I was replying to a comment about education and IQ and explained I didn't believed in ethnic differences of IQ, but also in IQ altogether - <http://news.ycombinator.com/item?id=4680279>

At least looking for "dumb genes" is more plausible, because if IQ is an aggregate of multiple functions, some functions could be separately damaged

Copy paste:

 _The current perspective of IQ and ethnicities show that while there might be slight differences, they are dwarfed by the differences in the education process.

Regarding IQ:

First, I don't believe that IQ exist as a measurable quantity - IQ is too many things thrown together in a single bad. Tests group together various things which may be handled by different subsystems in the brain. If there is something called IQ, it's an aggregate.

Anyway, if there was such a unique quantity, actual data shows a progression of IQ scores in time - therefore if the tests are considered accurate and unbiased, it must be a "quantity" that can evolve based on the society a person lives it. It should then be considered not as a value, but as a function depending on a variable called society.

I do not know if studies have tried to measure the accuracy of repetitive measurement in low education adults enrolled in a learning program. If there are such studies and if they show inconsistent result (ie any change of IQ), then IQ should be considered as a function of 2 variables : f(society, personal experience).

Now, even if we consider that at a time t it could be accurately measured and that societal bias could be removed, considering how other qualities (such as determination, work ethic, consistency, creativity, competitiveness...) influence the outcome of any human activity, it seems foolish to rank people based on just one quality - especially if we don't know the other values, and their individual ponderation in the end result.

This ponderation could also be different depending on the activity, and IQ provide an absolute advantage in some activities (rhetoric?), but say determination would give an absolute advantage in other activities (startups?)._

<comment><USER7> >Anyway, if there was such a unique quantity, actual data shows a progression of IQ scores in time - therefore if the tests are considered accurate and unbiased, it must be a "quantity" that can evolve based on the society a person lives it. It should then be considered not as a value, but as a function depending on a variable called society.

Seriously? Couldn't it just be the subjects getting used to the tests? That's not the point though. It doesn't mean subjects are getting smarter. It just means they are learning, which is natural. However if we have two subjects and subject A gets 115 IQ points the first time while subject B gets 104, 111, 113, 115 IQ points after four consecutive test respectively, it's clear that subject A is superior intellectually in that they can achieve more in less time.

<comment><USER9> That's not exactly the idea. See <http://en.wikipedia.org/wiki/Flynn_effect>

Maybe a full society is getting used to the tests, or maybe the tests are biased.

Even with you example (considering repetitive test at the same time on 2 person from the same society), it could show many things: a) that the measurement is flawed b) that you should retest A to see if he also get better scores c) failing that, A has a fixed IQ score while B can improve d) if A improves too what's the limit?

Finally, "it's clear that subject A is superior intellectually " - even if B would get say 120 on its final test while A ends with 118??

</comment></comment></comment><comment><USER10> Which seed will grow better depends not just of its genes, but also of environment, weather and of how much it was fertilized.

This, for example, is one of the answers why _rich getting richer_. The difference in environment + variety of experience matters much more than difference in genes, in cases where there is no inherited disorder.

By changing environment, behavior and altering mental models (unlearning the learned helplessness, for example) it is possible to improve even IQ scores.

This is how the Flynn effect works - it is effect of the environment + variety of experience.

</comment><comment><USER2> During commencement at our medical school, one of the second-years on stage said "I know what you're all thinking: you were expecting all sorts of crazy intellectuals and artists. But everyone is so . . . normal."

<comment><USER11> 'Real' crazy intellectuals and artists don't study medicine, they study the Humanities or don't study at all. The rigor and discipline required of medical students and doctors would actually favour those being 'normal'; I wouldn't, personally, have expected anything else.</comment></comment>


Ask HN: Best example for teaching the basics of object oriented programming - <AUTHOR>

Hi all,
I'm in the process of writing yet another introductory course to programming for complete beginners.
I'm looking for a great example context for my OO chapter, beyond the ubiquitous Animal or Vehicle hierarchy.
Thanks in advance for all your great ideas! <comment><USER2> Why not use a real-world example of something you would write a class for? The best tutorials are the ones that teach you things you can actually use. I've never used an Animal or Vehicle class myself. A better example might be to write something like an Article class, and then build out to a very simple and minimal blog?

<comment><USER3> That's a good point. As a second suggestion, I think I liked Dive Into Python's example of a mp3-file metadata parser, from way back when I learned python

[http://www.diveintopython.net/object_oriented_framework/inde...](http://www.diveintopython.net/object_oriented_framework/index.html)

</comment></comment><comment><USER4> I'm not an expert on the topic, but this book[1] has an incredibly good and easy-to-understand introduction on the topic. It's ruby-based but the ideas apply to OO design in general.

[1] [http://poodr.com](http://poodr.com)

</comment><comment><USER5> How about a pen?

A pen is tangible and has properties.

        pen.brand = 'bic';
        pen.inkColor = 'black';

etc</comment>


All premium WordPress themes looks the same - <AUTHOR> https://www.proteusthemes.com/blog/wordpress-themes-look-the-same-consultpress-consulting/ <comment><USER2> Cannot actually agree! I have recently discovered a perfect WordPress theme that looks absolutely different. Here is actually the link - [https://www.templatemonster.com/wordpress- themes/monstroid2....](https://www.templatemonster.com/wordpress- themes/monstroid2.html) . It's highly customisable offering a simple drag&drop interface.</comment>


Differentiable Programming Mega-Proposal - <AUTHOR> https://forums.swift.org/t/differentiable-programming-mega-proposal/28547 <comment><USER3> Capitalizing on the presence of people who might be new to Automatic Differentiation and want a deeper understanding of how it works, here is an interactive Colab notebook I wrote about this topic entitled "Build your Own TensorFlow" for the Deep Learning Indaba that just happened in Kenya: [https://colab.research.google.com/drive/14GeXkFd5pQKKNIJ7BMs...](https://colab.research.google.com/drive/14GeXkFd5pQKKNIJ7BMswP0ihlYg5nIbS#forceEdit=true&offline=true&sandboxMode=true)

<comment><USER4> That's an excellent tutorial - more are available on [http://www.deeplearningindaba.com/practicals-2019.html](http://www.deeplearningindaba.com/practicals-2019.html) for those interested.

</comment></comment><comment><USER5> I don't see why a well written library could not serve the same purpose. It seems like a lot of cruft. I doubt, for example, Python would ever consider adding this and it's the defacto language that would benefit the most from something like this - due to the existing tools and communities.

It just seems so narrow and not at the same level of abstraction that languages typically sit at. I could see the language supporting higher level functionality so a library could do this without a bunch of extra work (such as by some reflection).

<comment><USER6> I would counter that differentiable programming should perhaps rise to the level of baseline functionality that most languages should offer.

I think the applications for automatic differentiation and gradient optimization well exceed what we think of as ML and data science today.

</comment></comment><comment><USER7> I'm not a Swift programmer, so perhaps my confusion is just a symptom of broader ignorance, but I find two things unclear here: \- What does 'first- class' mean, really? \- Which of these benefits are unique to integrating notions of derivatives into the language, and which could be enjoyed well- written libraries?

The mega-proposal links out to a separate doc on embedded DSLs, with broad statements about what's "typical" or "often" true of existing DSLs -- but which of those issues are insurmountable? That section mentions Swift's limited metaprogramming facilities. Why choose to carve out this added support for a single family of algorithms rather than add in some more general metaprogramming abilities that enable better EDSLs?

<comment><USER8> My understanding of automatic differentiation (AD) is that it's only really possible at the compiler level, since you need the ability to interpret and manipulate function definitions themselves. Certainly, no library would be able to offer the same level of guarantees telling you if you've done it wrong, nor the same opportunities for optimisation.

<comment><USER7> It's certainly not the case that autodiff is only possible at the compiler level. I've implemented forward mode (via dual numbers) and reverse mode (via tapes / wengert nodes) autodiff in libraries before.

<comment><USER9> notice the qualifier "really". obviously you can implement autodiff kind of outside the complier since pytorch and tensor flow exist. but those implementations constrain you to a select few compositions (please no comments on Turing completeness with just loops and conditionals). so for example if statements in pytorch are not differentiable (they might have piece wise continuous derivates) because pytorch doesn't actually trace the ast. I'm not a languages expert but outside of implementing in the compiler I imagine you'd need a homoiconic language to implement as a library.

<comment><USER10> If statements aren't _really_ meaningfully differentiable, regardless of how you do it.

Take

        if x == 59:
            return 1000
        else if x > 59:
            return -x
        else:
            return x

How do you optimize this to maximize x, regardless of what language you're in?

It's true that you can get a derivative, but the derivative is essentially meaningless.

<comment><USER9> I don't understand? It's a piecewise differentiable function and you maximize how you maximize any such function: do gradient ascent where it's differentiable and compare against values at the boundary points (ie start, end of interval and points at which there's a removable discontinuity).

<comment><USER10> I don't disagree that a gradient exists. As the other commenter commented, the gradient/subgradient will usually exist.

What I'm arguing is that this gradient will not allow you to optimize anything of interest for the vast majority of programs.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> If you are interested in following along, the Swift for TensorFlow team has a design meeting every Friday. The meetings are live-streamed and anyone can join. I recommend them if you are curious and want to hear more about the challenges and opportunities! A recent talk had Jeremy Howard (of fasti.ai fame) present the full-featured deep learning API he has designed on top of Swift for TensorFlow.

You can find out more on the mailing list [https://groups.google.com/a/tensorflow.org/forum/m/#!forum/s...](https://groups.google.com/a/tensorflow.org/forum/m/#!forum/swift)

</comment><comment><USER11> How does this relate to all the work that Christ Lattner et al have been doing at Google with Swift, MLIR, etc.?[a]

Is this... a separate, parallel, more encompassing proposal?

Is there any coordination between these two groups?

\--

[a] [https://www.youtube.com/watch?v=yCd3CzGSte8](https://www.youtube.com/watch?v=yCd3CzGSte8)

<comment><USER12> I don't know if "Christ" Lattner was intentional (humorous) or an accident, but I chuckled.

<comment><USER11> Accident.

</comment></comment></comment><comment><USER13> How does this compare to Jax? [https://github.com/google/jax](https://github.com/google/jax) Why do this in the language instead of a library?

<comment><USER3> Probably the main justification is that the analysis and transformation steps needed to compute the vjp and jvp pullbacks of a function (which correspond to reverse- and forward-mode automatic differentiation) require enough of the other machinery of a compiler that they are best done WITHIN a compiler. Then other things become quite natural, too, like producing the tangent vector versions of data structures like tuples and maps!

Moreover, a statically typed language like Swift is a much better starting point for this kind of effort than Python. Array shapes and dimensions are already a type system - you might as well go the whole distance and get all the other safety, readability, and efficiency benefits!

PS shout out for named array axes as the future of array-based (and hence differentiable) programming... see [http://nlp.seas.harvard.edu/NamedTensor](http://nlp.seas.harvard.edu/NamedTensor) for a good rationale

<comment><USER13> jax does have a just in time compiler that lets you compile your python functions to XLA-optimized kernels (through llvmlite under the hood?).

The fact that you can jit compile and gain the benefits of "doing this within the compiler" is one of its main selling points.

</comment></comment></comment><comment><USER14> This will certainly help people who work on new deep learning theories and model architectures, but not so much the large crowd of deep learning practitioners.

In his excellent interview with Lex Fridman, Yann LeCun was critical of any approach to AI that was not differentiable, even constraint satisfaction, and other solid optimization techniques. In the context of scaling to very large problems or models with many billions of parameters, he is probably correct.

I have had problems with the Swift and TensorFlow code drops. Sometimes they work for me and sometime they don't. So, very good technology but perhaps wait for it to mature. I read that some students for the fast.ai course using Swift have also had some setup difficulties.

EDIT: you might also want to look at Julia for differentiable programming and Julia with deep learning libraries like Flux is also a 'turtles all the way down' system, where unlike TensorFlow where the guts are implemented in C++, for Swift and Julia the entire stack can be implemented in a single language.

</comment><comment><USER8> This is actually huge. I saw a proof of concept of something like this in Haskell a few years back, but it's amazing it see it (probably) making it into the core of a mainstream language.

This may let them capture a large chunk of the ML market from Python - <USER2> hopefully greatly improve ML apis while they're at it.

<comment><USER15> Huh? Nobody is writing numerically intensive libraries in Python. Clearly this language proposal is taking aim at C++ and Fortran. Even if this caused TensorFlow & others to rewrite everything in Swift, people would write Python bindings to it and keep using Python.

I'll get excited if Apple actually merges this into Swift. It's a niche feature that their compiler team will need to maintain forever. I actually have been working on algorithmic differentiation in C++, so it's not even that I wouldn't want to try Swift out if it actually made it in. However, because this sort of thing is of such narrow interest I believe the future will stay with embedded DSLs / libraries / ugly macro/template hackery.

<comment><USER9> lol this is literally by the group that's rewriting tensorflow in Swift [https://www.tensorflow.org/swift](https://www.tensorflow.org/swift) so you're off on the intention here in that it is exactly taking aim at python as the main data ecosystem language.

</comment></comment></comment><comment><USER16> I'm curious (for folks in the know): how does differentiable programming handle non-differentiable points? Can it detect non-differentiable/non-smooth functions?

Non-smooth functions like abs(), max(), min() have points where derivatives do not exist. ReLU functions are non-differentiable at their hinge points.

Disjoint IF-THEN-ELSE conditions are discontinuities in the function space, and are traditionally handled in optimization with mixed-integer formulations (i.e. split up the space and do something clever like branch-and-bound to find the optimum).

<comment><USER10> Other people have answered what they do, but this is the big gap between people talking about 'differentiable programming' in theory, and having it actually work in practice.

It's true that once you have control flow, the gradient quickly becomes meaningless. I posted an example here: [https://news.ycombinator.com/item?id=20892287](https://news.ycombinator.com/item?id=20892287)

That's also the biggest reason I tend to find much of this "differentiable programming" stuff to be overhyped. It's _hard_ to reformulate programs in a way s.t. the derivative can mean something meaningful. And I'm not convinced traditional languages will benefit.

That's not to say that there isn't cases where your program can be formulated to have a meaningful derivative.

See this differentiable ray tracer: [https://people.csail.mit.edu/tzumao/diffrt/](https://people.csail.mit.edu/tzumao/diffrt/)

<comment><USER3> > It's hard to reformulate programs in a way s.t. the derivative can mean > something meaningful.

Really? The gradients computed by AD are the exact answer to the following question: if I were to change this input or parameter an infinitesimal amount, how much would it change the output of my function? That is _always_ meaningful (when it is defined), and means what I just said. You can easily make functions where it is not defined, of course, just like you can make a sphere into two spheres with the Banach-Tarski theorem!

But there are vast, vast forests of numerical computation employed in industry, science, finance, engineering, where it is _almost always_ defined.

And even for more "chunky" computations where the non-differentiability is more severe, there are algorithms like REINFORCE that you can use to estimate gradients through these parts.

<comment><USER10> It's not meaningful in the sense that it won't correspond with your intuition of "will increasing the input increase my output". Presumably the point of differentiable programming isn't just getting the derivative for fun, it's for optimizing some quantity.

For example, take this code.

         x,y
         for (int i=0; i<x; i++)
             y += 1
         return y

It's technically true that the gradient of 0 is correct (modulo boundaries). But if someone was trying to optimize this function, that's not very helpful.

I believe REINFORCE is not of much help either - it's not magic. I'm not aware of any stochastic gradient estimators that are helpful in this case (although if there is a method I'd like to hear about it).

</comment></comment></comment></comment><comment><USER17> I'm really excited for this. I'm unaware of any mainstream language with first class support for differentiation, I think its going to be really interesting to see what people use it for out side of ML.

<comment><USER18> Julia is in the same space.

<comment><USER17> Julia is great but it doesnt play in the domain of apps and servers

<comment><USER19> Yes it does. See genie.jl for a full mvc framework. Also there's mux.jl and http.jl.

</comment></comment></comment></comment><comment><USER20> I really like the idea of building AD directly into the language and compiler infrastructure itself, but the challenge of upstreaming it in a language built for very specific tasks makes me concerned. Is Latner just going to end up making a GSwift? Will it just be forked?

</comment><comment><USER21> Ew, that's really not something I would do at the language level...

</comment><comment><USER22> This is super exciting

</comment><comment><USER18> Now do automatic integration.

</comment><comment><USER23> Well done Swift. Insightful language design.

</comment><comment><USER24> Can "Differentiable Programming" be related to "Differentiable Privacy", or have we now one word (and acronym!) to describe two different things?

<comment><USER25> I think you meant " _differential_ privacy", and no, it's not closely related to differentiable programming.

[1] [https://en.wikipedia.org/wiki/Differential_privacy](https://en.wikipedia.org/wiki/Differential_privacy)</comment></comment>


Envelope – Postgres database to web app with just HTML and SQL - <AUTHOR> http://envelope.xyz/ <comment><AUTHOR> We are happy to announce the release of Envelope v1.0.0 today.

Envelope is a complete platform that makes building web apps on top of PostgreSQL easy.

Envelope is free, open source, offered under a PostgreSQL style license, compatible with modern and mobile browsers, production ready and available today at envelope.xyz.

All you need to know is SQL, and some HTML and you can publish your database as a web application with Envelope!

Envelope source code is available on Github but free installers are available for Mac, Linux and FreeBSD. Visit envelope.xyz and click on "Install" to get your copy.

<comment><USER2> > All you need to know is SQL, and some HTML

So it's a reimagined ColdFusion? :-)

<comment><AUTHOR> I admit, I don't use CF.

I looked at the Wikipedia entry for it and I see its heavy on server side programming. Envelope replaces server side programming.

CF uses server side programming to make components whereas Envelope uses Javascript web components on the client side.

Their seems to be a lot of overlap in expected use cases. Internal apps, data- driven apps.

I apologize, I can't really assert much else do to lack of experience with CF.

<comment><USER2> Aside from implementation details, I think the premise is the same: simple data access using SQL and rendering using familiar HTML-like syntax for markup and logic. CF of course came about at a time when browsers were far less capable (1995), so rendering is of course on server. Additionally, I think CF probably has more middleware, but I really haven't given Envelope much of a look (you really need a standard docs page)

<comment><AUTHOR> Check out the live demo. The docs are very extensive, but they work best inside the IDE.

</comment></comment></comment></comment></comment><comment><USER3> Really cool project, not so cool website. Here's some feedback:

* Took me a minute to realize I can't scroll when my mouse is outside the center container

* Drop the sticky header/footer (let them scroll with the content)

* Add a bit more padding / line-spacing on the content on most pages (especially the Install page)

* Optimize (scale down?) the images on the support page so they load quickly (they seem pretty heavy)

Great work, though!

<comment><AUTHOR> Fixed! Thank you for the feedback! I apologize for the look, none of us here are designers but we try hard.

People that aren't seeing the changes need to hit refresh on their browser. I apologize for the confusion.

<comment><USER3> I am no designer either, which is why every project of mine starts with Bootstrap :D

</comment></comment></comment><comment><USER4> I have a suggestion: Put a demo on your web site.

edit: Another suggestion... use a proper source of random numbers in init_aes_key_iv(). Using the time isn't good.

<comment><AUTHOR> We moved to:

        time(NULL) * getpid() * clock()

Thanks!

<comment><USER5> That's still not a good idea. Use your OS' random source.

<comment><AUTHOR> We wanted to avoid anything controversial. Do we need to make this configurable to make everyone happy?

[https://www.schneier.com/blog/archives/2013/10/insecurities_...](https://www.schneier.com/blog/archives/2013/10/insecurities_in.html)

<comment><USER6> Even if it isn't perfect /dev/random is a hell of a lot more random than just taking the current time stamp and PID.

Edit: For reference, this is _exactly_ how the Netscape's original SSL implementation was broken: [https://web.archive.org/web/20141214141822/http://www.cs.ber...](https://web.archive.org/web/20141214141822/http://www.cs.berkeley.edu/~daw/papers/ddj- netscape.html)

<comment><AUTHOR> Understood. Working on it now.

<comment><AUTHOR> Fixed!

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Did nobody else think of the old SQL on Rails (April Fools) screencast as soon as they saw this headline? [https://www.youtube.com/watch?v=0_PK1eDQyVg](https://www.youtube.com/watch?v=0_PK1eDQyVg)

<comment><AUTHOR> Funny!

</comment></comment><comment><AUTHOR> Special thanks to Domingo Alvarez Duarte 'mingodad' for submitting the first community pull request. Merged in three minutes!

<comment><USER7> That's the beauty of open source ! Cheers !

</comment></comment><comment><USER8> How is using Postgres DB users as website users working for you? Is having thousands or millions of users practical, or is this intended more for a limited-use in house application? Is it practical to allow new users to register on the site and have a site admin manage their roles and permissions through a web interface, or do DBAs need to manage that stuff manually in psql?

I worked on an internal website once on MS stack where management wanted to try and authorize access to the webapp through access permissions to the backend MSSQL database, with the Windows Domain user getting picked up automatically through IE. It was a mess to get even kinda working and to debug, and we were never able to get it all the way working.

<comment><AUTHOR> > How is using Postgres DB users as website users working for you?

Fricken awesome. Very easy to sleep at night. We can do a complete security audit in fifteen minutes.

> Is having thousands or millions of users practical, or is this intended more > for a limited-use in house application?

Envelope is a very small C binary. You'll find it scales way better than PostgreSQL itself and as such you should be able to apply similar strategies. You'll find your database design is way more important than the Envelope overhead. If you were going to open a site to millions of users I would consider pooling users into groups so you could pool PostgreSQL connections. Again, the bottleneck isn't Envelope, but PostgreSQL.

> Is it practical to allow new users to register on the site and have a site > admin manage their roles and permissions through a web interface, or do DBAs > need to manage that stuff manually in psql?

We don't use psql. Envelope includes Postage, a sort of web based PGAdmin. Developers can use that to administrate the database. We've also written a 'User Admin' app for non-developers that we've installed into some of our client Envelope instances. This allows the customer to administrate their own users.

> ...management wanted to try and authorize access to the webapp through > access permissions to the backend MSSQL database, with the Windows Domain > user getting picked up automatically through IE...we were never able to get > it all the way working.

Sorry to hear that. Our app was originally written in just a couple of hours but I didn't even know you could get the Domain User in IE. I'll have to try that.

<comment><USER9> Hey, do you have a link for postage?

<comment><AUTHOR> Open the live demo. There are two links. One for postage connecting to your development copy and the one connecting to the production database.

</comment></comment></comment></comment><comment><USER10> This is an awesome tool, and reduces complexity for the easiest of the CRUD applications.

however, for anything that needs even slightly more complicated scenarios such as decisioning etc -- the SQL gets really complicated to build and test.

I am suggesting that this could be extended with a possible rules engine like drools, which is bundled in, and uses an object model that is the same as the table structure.

Data is fetched from the db, this data is reasoned on in the rules engine (and filtered) and this data is then either updated to the db ( sent to back tier ) or displayed on the screen ( sent to front tier ).

Hence a complicated SQL query can be broken into a bunch of rules that are reused across scenarios.

<comment><AUTHOR> We have complete ERP systems with kitting, lot control inventory, etc. all of it straight forward and easy to maintain. Plpgsql is made for this stuff.

We also like having all the display handled in the html with web components. We really like the separation. I Don't think we can help you.

</comment></comment><comment><USER11> Is "Greyspots" just Polymer? There seems to be no real info on the site about it?

<comment><USER12> No, our custom elements does sound similar to Polymer but there are two main differences: we don't use ShadowDOM (polymer does) and our elements are for creating Postgres backed web apps.

Greyspots has two parts: the front end and the Envelope Server. The front end is comprised of custom HTML tags and a JS library (We use X-tags to implement custom tags). The Envelope Server is a middleware replacement that exposes a fixed API from the front end to a Postgres database.

<comment><USER11> Ah I was more thinking Greyspots referred exclusively to the front end JS library, not both sides. Cheers for the clarification.

</comment></comment></comment><comment><USER13> I'm a DBA who wants to make the occasional simple web-app, mostly for a small number of internal users at my company. This looks great! Thank you :)

</comment><comment><USER14> This looks cool, but if I'm already going to write the HTML and the SQL I'll just write the app. I already have a framework and method to do that anyway and I don't have to learn a new system or be locked to some way of doing things that may prevent customization and expansion.

Not to bag on the effort though. This may come in handy for someone.

<comment><AUTHOR> I don't understand. What we've done here is replace the web app architecture with a desktop app architecture. Desktop apps don't have customization or expansion problems so I wouldn't expect any here. Could you give me an example?

<comment><USER14> Well, to be fair, I was never fan of Access and do think it has customization and expansion problems. I have never built an app using Access, but I have gone through a few broken Access apps and re-written them into web apps. In my limited experience it allows clicker people to build themselves into trouble while making it difficult for them to fix what they build. Just my opinion though. I'm not complaining because I've made money re-writing some messes and making them functional and beautiful.

Dragonwriter's reply (below) sort of sums up my view also. I am not a fan of jamming all the logic in the SQL and like a middle layer... actually need a middle layer to carry out operations on the data before it is presented. I would prefer not to use JS for this.

But again.. I'm sure this project has some uses and would be handy for some people. It's a cool idea and a cool project and I commend your effort. It's just not something I personally would chose to use. Please don't take that the wrong way....

<comment><AUTHOR> > actually need a middle layer to carry out operations on the data before it > is presented.

I'm of the school that says you should fetch the data you want because the database is optimized for data operations. can you give me an example of a data operation that's best done in middleware?

<comment><USER14> Just about anything in which the SQL is considerably more complex or a lot longer than then the corresponding middleware code.

Just about anything in which the SQL query is considerably more difficult to debug or get intermediate verification than in the corresponding code.

SQL does many things well. So far, it doesn't do everything as well as middleware code. It isn't as easy to use for every use case as middleware code. Long complex SQL queries are a nightmare to unravel. Middleware code can more easily (in my experience) be broken up into smaller steps that can be manipulated and tested independently.

<comment><AUTHOR> Postgis is an example of a very extensive code base in Postgres. I've listed a bunch of apps that Envelope is great for. You haven't given me an example of what you are talking about so I can't really respond to your comments.

</comment></comment></comment></comment></comment></comment><comment><USER15> I couldn't imagine wanting to use sql to make a site.

<comment><AUTHOR> You write HTML documents to make the apps. Those are then stored to the file system like normal. When you load the app in the browser, the components (just custom HTML tags) connect through Envelope to your database.

Also, it's not for static web sites, it's for web applications. For example accounting, wiki, calendar, address book etc.

You'd never write any of the site in SQL. You do write your VIEWs, queries and any functions you need in SQL. Then you connect to those things with some of your components.

<comment><USER16> > You write HTML documents to make the apps.

The front-end of the apps. Since the application layer in a typical n-tier architecture is replaced with a generic, application-neutral layer, the back- end business logic is, of necessity, all moved into the database (unless you propose moving that into the front end, which I suspect you don't.)

This isn't the first time this type of thing has been proposed, and its not necessarily a bad idea, but there are a number of concerns associated with it (particularly, that scaling out a typical middle-tier is often easier than scaling out Postgres, so this approach may limit scalability of the resulting apps.)

<comment><AUTHOR> > Since the application layer in a typical n-tier architecture is replaced > with a generic, application-neutral layer, the back-end business logic is, > of necessity, all moved into the database

Yes! Just like a typical desktop app! What we've done here is just simplify the web architecture down to a typical desktop architecture.

> This isn't the first time this type of thing has been proposed, and its not > necessarily a bad idea,

All us desktop application developers agree. This isn't new at all. We use it every day. MS Access, .NET, Borland, Filemaker and many other tools used the exact same architecture for many many years.

> but there are a number of concerns associated with it (particularly, that > scaling out a typical middle-tier is often easier than scaling out Postgres, > so this approach may limit scalability of the resulting apps.)

Hmmm. I am not a middle tier scale person so I can't speak to comparison. I will point out you could easily have one Envelope serving out to ten PostgreSQL databases before you need to introduce another Envelope instance. Meanwile, Envelope is a microservice so scaling is just a simple NGINX config change. This looks relevent: [http://spin.atomicobject.com/2012/02/28/load- balancing-and-r...](http://spin.atomicobject.com/2012/02/28/load-balancing- and-reverse-proxying-with-nginx/)

<comment><USER16> > Yes! Just like a typical desktop app!

A typical desktop app has the application logic in an application language, not the backend DB (if it even has a backend DB.)

> What we've done here is just simplify the web architecture down to a typical > desktop architecture.

Relational DB backend + declarative front-end (HTML or otherwise) with no application logic in an intermediate layer between those isn't the typical desktop architecture, either.

> All us desktop application developers agree.

I mean, specifically, the RDBMS back-end with all business logic, generic middle-layer (possibly built into the database), and HTML front-end architecture for web apps has been proposed and provided before. But not really taken off.

<comment><AUTHOR> Let me give you an example. MS Access and a database. Sure I _could_ use the database as a dumb store and write reams of VBA, but that's not how I do it. I write functions in plpgsql and have minimal code in VBA. In my practice VBA and JavaScript are used in very much the same way.

One of the great things about writing apps this way is you can easily migrate your MS Access database to the web. Or use both at the same time, say, MS Access for the desktop and Envelope for mobile users. Then when someone hits a "ship" button the same code runs regardless. This is the original Oracle model published in their very earliest manuals.

I know lots of people don't take advantage of the database for stored procedures/functions but I wasn't thinking about them when I wrote my previous comment. I apologize.

</comment></comment></comment></comment></comment></comment><comment><USER17> Spent some time browsing around the demo. Sorry to be critical. This doesn't seem to be a web app that anyone in their right mind would want to use.

It's all fun and games until your DB administrator gives you an Envelope built app that you have to use every day.

<comment><AUTHOR> Could you be more specific? We've got customers working with apps every day and they are happy. If they weren't happy we wouldn't have had time to release it as open source...</comment></comment>


Using EMPs: A new way to punch through steel - <AUTHOR> http://www.economist.com/sciencetechnology/displayStory.cfm?story_id=15268879

<comment><USER2> Apparently it is a refined version of this:

<http://www.engineershandbook.com/MfgMethods/emforming.htm></comment>


Ask HN: What owner operated small businesses do you interact with frequently? - <AUTHOR> <comment><AUTHOR> OP here. I live in San Francisco but am visiting Vancouver. It struck me how many of the food places I ate at were operated by a single owner. I feel this is rare in SF because of the permit requirements and high startup costs.

</comment><comment><USER2> Food services are the majority but also legal services, financial advisor, etc. I live in a small town so there are many small owner-operated establishments, more so than in large cities (well, per-capita maybe)</comment>